CVE-2016-10147: Null Pointer Dereference
Algorithms not compatible with mcryptd could be spawned by mcryptd with a direct cryptoalloctfm invocation using a "mcryptd(alg)" name construct. This causes mcryptd to crash the kernel if an arbitrary "alg" is incompatible and not intended to be used with mcryptd.
This could be a potential attack to crash the kernel by user program using AFALG to request an invalid algorithm such as mcryptd(md5).
Upstream report:
https://marc.info/?l=dm-devel&m=148063708010538&w=2
Suggested Patch:
http://marc.info/?l=linux-crypto-vger&m=148096718218312&w=2
Upstream patch:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=48a992727d82cb7db076fa15d372178743b1f4cd
CVE-ID request and assignment:
http://seclists.org/oss-sec/2017/q1/118
http://seclists.org/oss-sec/2017/q1/127
Other sources
crypto/mcryptd.c in the Linux kernel before 4.8.15 allows local users to cause a denial of service (NULL pointer dereference and system crash) by using an AFALG socket with an incompatible algorithm, as demonstrated by mcryptd(md5).
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2016-10147?
The severity of CVE-2016-10147 is medium.
How can local users exploit CVE-2016-10147?
Local users can exploit CVE-2016-10147 by using an AF_ALG socket with an incompatible algorithm, such as mcryptd(md5), to cause a denial of service.
Which versions of Linux are affected by CVE-2016-10147?
Linux kernel versions before 4.8.15 are affected by CVE-2016-10147.
How do I fix CVE-2016-10147?
To fix CVE-2016-10147, you should update your Linux kernel to version 4.8.15 or later.
Where can I find more information about CVE-2016-10147?
You can find more information about CVE-2016-10147 at the following references: [Reference 1](https://marc.info/?l=dm-devel&m=148063708010538&w=2), [Reference 2](http://marc.info/?l=linux-crypto-vger&m=148096718218312&w=2), [Reference 3](https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=48a992727d82cb7db076fa15d372178743b1f4cd).